Connecting your domain to Cloudflare takes twenty minutes and immediately gives you a CDN, free SSL and DDoS protection. But the defaults are conservative. These six settings are what I change on every site.
1. Set SSL/TLS to Full (strict)
This is the one that matters most. Cloudflare defaults to a mode that can cause redirect loops and leaves part of the connection unencrypted. If your host has a valid certificate — most do — choose Full (strict). If you see a redirect loop after switching, this setting is almost always the cause.
2. Enable Always Use HTTPS
Under SSL/TLS → Edge Certificates. It redirects every HTTP request to HTTPS at the edge, before it reaches your server. Faster than a plugin-level redirect and impossible to bypass.
3. Turn on Automatic HTTPS Rewrites
Fixes mixed-content warnings by rewriting insecure asset URLs on the fly. Essential if your site has old posts with hardcoded http:// image links — it saves hours of manual editing.
4. Set Browser Cache TTL to at least 4 hours
Under Caching → Configuration. Longer caching means returning visitors load almost nothing from your server. Four hours is safe for most blogs; a day is fine if you rarely change assets.
5. Enable Auto Minify and Brotli
Under Speed → Optimization. Minifying removes whitespace from CSS, JavaScript and HTML; Brotli compresses better than gzip. Both are one-click and reversible.
6. Set up automatic cache purging
Without this, visitors see stale pages after you publish. Install the official Cloudflare plugin in WordPress and connect it with an API token — it purges the cache automatically whenever you update content.
Three things to be careful with
- Development mode — use it while editing your site so you are not debugging a cached page
- Rocket Loader and aggressive JS optimisation — can break sliders and forms; test before keeping
- Firewall rules — one badly written rule can block real visitors; start with managed rules only
How to verify it is working
Load a page, open developer tools, and check the response headers. If you see cf-cache-status: HIT, Cloudflare served the file from its cache. Check your page again with PageSpeed Insights after 24 hours — the improvement for distant visitors is usually obvious.
What the free plan does not include
Image optimisation, a stronger WAF, priority support and advanced analytics sit on paid plans. For most blogs and small business sites, the free tier plus these six settings is everything you need.
